Initial commit: Add disaster recovery & migration pipeline
This commit is contained in:
Haitao Pan
parent
bcc760a79a
commit
8dc5efd04c
149
.github/workflows/deploy-env-migration.yaml
vendored
Normal file
149
.github/workflows/deploy-env-migration.yaml
vendored
Normal file
@ -0,0 +1,149 @@
|
||||
name: Deploy Environment & Migrate Data (Data Sync)
|
||||
|
||||
# =============================================================================
|
||||
# IaC ↔ 数据流单向迁移流水线
|
||||
# 1. 动态 Provision (基于 Terraform 创建新环境)
|
||||
# 2. 部署基础服务 (Bootstrap 部署，跑空环境)
|
||||
# 3. 生产环境克隆与单向同步 (通过 site_migration Ansible 角色)
|
||||
# =============================================================================
|
||||
|
||||
on:
|
||||
workflow_dispatch:
|
||||
inputs:
|
||||
infra_ref:
|
||||
description: "ai-workspace-infra git ref"
|
||||
required: false
|
||||
default: "main"
|
||||
type: string
|
||||
source_host:
|
||||
description: "源环境 IP 或域名 (用于导出数据)"
|
||||
required: true
|
||||
default: "install.svc.plus"
|
||||
type: string
|
||||
source_domain_base:
|
||||
description: "源环境域名后缀 (例如 svc.plus)"
|
||||
required: true
|
||||
default: "svc.plus"
|
||||
type: string
|
||||
target_domain_base:
|
||||
description: "新环境域名后缀 (用于参数化替换，如 onwalk.net)"
|
||||
required: true
|
||||
default: "onwalk.net"
|
||||
type: string
|
||||
run_provision_and_deploy:
|
||||
description: "是否执行 Provision 和基础环境 Deploy? (如果只迁移数据则取消勾选)"
|
||||
required: false
|
||||
default: true
|
||||
type: boolean
|
||||
|
||||
permissions:
|
||||
contents: read
|
||||
id-token: write
|
||||
|
||||
concurrency:
|
||||
group: deploy-env-migration
|
||||
cancel-in-progress: false
|
||||
|
||||
env:
|
||||
VAULT_ADDR: https://vault.svc.plus
|
||||
VAULT_ROLE: github-actions-xworkspace-console
|
||||
VAULT_KV: kv/data/CICD
|
||||
PLAYBOOKS_DIR: infra/playbooks
|
||||
|
||||
jobs:
|
||||
# ---------------------------------------------------------------------------
|
||||
# 步骤 1: 基础设施配置与启动 (Provision)
|
||||
# [可直接参考 deploy-ai-workspace-iac.yaml 中的 provision]
|
||||
# ---------------------------------------------------------------------------
|
||||
provision:
|
||||
name: Provision New Environment (Terraform)
|
||||
if: ${{ github.event.inputs.run_provision_and_deploy == 'true' }}
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- name: Checkout infra
|
||||
uses: actions/checkout@v7
|
||||
with:
|
||||
repository: ai-workspace-infra/iac_modules
|
||||
ref: ${{ github.event.inputs.infra_ref }}
|
||||
path: infra/iac_modules
|
||||
|
||||
- name: Load Vault secrets
|
||||
id: vault
|
||||
uses: hashicorp/vault-action@v4
|
||||
with:
|
||||
url: ${{ env.VAULT_ADDR }}
|
||||
method: jwt
|
||||
role: ${{ env.VAULT_ROLE }}
|
||||
secrets: |
|
||||
${{ env.VAULT_KV }} VULTR_API_KEY | VULTR_API_KEY ;
|
||||
|
||||
# 省略实际 Terraform Apply 步骤 (参考原有 IAC 流水线)...
|
||||
- name: Placeholder for Terraform Apply
|
||||
run: echo "Terraform applies new infrastructure and outputs target IPs..."
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# 步骤 2: 基础环境安装 (Bootstrap Deploy)
|
||||
# ---------------------------------------------------------------------------
|
||||
deploy_base:
|
||||
name: Deploy Base Services
|
||||
needs: provision
|
||||
if: ${{ github.event.inputs.run_provision_and_deploy == 'true' }}
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- name: Placeholder for Ansible Base Deploy
|
||||
run: echo "Run on-host-bootstrap.sh on new nodes..."
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# 步骤 3: 全站单向数据流迁移与环境恢复 (Data Migration)
|
||||
# ---------------------------------------------------------------------------
|
||||
data_migration:
|
||||
name: Migrate Site Data (Source -> Target)
|
||||
needs: deploy_base
|
||||
# 即使不执行 Provision，也可以单独触发纯数据同步
|
||||
if: ${{ always() }}
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- name: Checkout playbooks
|
||||
uses: actions/checkout@v7
|
||||
with:
|
||||
repository: ai-workspace-infra/playbooks
|
||||
ref: ${{ github.event.inputs.infra_ref }}
|
||||
path: infra/playbooks
|
||||
|
||||
- name: Install Ansible
|
||||
run: pip install --quiet ansible
|
||||
|
||||
- name: Load Vault secrets for SSH
|
||||
id: vault
|
||||
uses: hashicorp/vault-action@v4
|
||||
with:
|
||||
url: ${{ env.VAULT_ADDR }}
|
||||
method: jwt
|
||||
role: ${{ env.VAULT_ROLE }}
|
||||
secrets: |
|
||||
${{ env.VAULT_KV }} SSH_PRIVATE_DEPLOY_KEY_B64 | ANSIBLE_SSH_KEY_B64
|
||||
|
||||
- name: Configure SSH Key
|
||||
run: |
|
||||
mkdir -p ~/.ssh
|
||||
printf '%s' "${{ steps.vault.outputs.ANSIBLE_SSH_KEY_B64 }}" | base64 -d > ~/.ssh/id_deploy
|
||||
chmod 600 ~/.ssh/id_deploy
|
||||
|
||||
- name: Generate Migration Inventory
|
||||
run: |
|
||||
# 模拟从 IAC 或人工输入中获取 target_ip (这里假定 target_ip 是通过环境变量或输入传入)
|
||||
TARGET_IP="new_env_ip_placeholder"
|
||||
echo "[migration_source]" > inventory_migration.ini
|
||||
echo "${{ github.event.inputs.source_host }} ansible_user=root ansible_ssh_private_key_file=~/.ssh/id_deploy" >> inventory_migration.ini
|
||||
echo "" >> inventory_migration.ini
|
||||
echo "[migration_target]" >> inventory_migration.ini
|
||||
echo "${TARGET_IP} ansible_user=root ansible_ssh_private_key_file=~/.ssh/id_deploy" >> inventory_migration.ini
|
||||
|
||||
- name: Run Ansible Site Migration Playbook
|
||||
working-directory: ${{ env.PLAYBOOKS_DIR }}
|
||||
run: |
|
||||
ansible-playbook \
|
||||
-i ../inventory_migration.ini \
|
||||
migrate_site.yml \
|
||||
-e "target_domain=${{ github.event.inputs.target_domain_base }}" \
|
||||
-e "migration_flow.source.domain_base=${{ github.event.inputs.source_domain_base }}"
|
||||
Loading…
Reference in New Issue
Block a user